Perimeter
6/30/2011
04:52 PM
Commentary
Commentary
Commentary
Connect Directly
RSS
E-Mail
50%
50%
Repost This

Mass-Meshing A Gumblar Creation

Who doesn't love a new buzzword? 'Mass-meshing' is a new term that describes an old problem first presented by the Gumblar attacks in 2009

Recent media reports point to a supposed new type of attack that has been dubbed "mass-meshing" by the folks over at Amortize.

The Amortize report states, “We want to report a new type of mass-scale drive-by download attack that we'll dub "Mass Meshing Injection."" The report then goes on to explain what it is and how it differs from a SQL injection attack. The crux of their concern is that in this “new type” of attack, “Every redirector is itself an infected domain, which means blacklisting becomes more difficult and prune to false alerts.”

But that was exactly the case two years ago with Gumblar. From our ScanSafe blog post then:

“In a typical outbreak situation, there are compromised websites that act as a conduit for malware hosted on an attacker owned site. But in this case, the malware resides on thousands of legitimate (but compromised) websites.”

Of course, all those Gumblar-backdoored websites proved fertile grounds for other attackers to abuse, and in October 2009 we saw Zeus adapting this same method:

“Interestingly, compromised pages are also being injected with external source references to the malware contained on other compromised sites. Those who followed last week's report of the newest Gumblar technique will recall that unlike traditional compromises which simply inject pointers to malware hosted on an attacker-owned domain, in these attacks the compromised domain is also acting as host for the malware itself."

At the time, we also noted that:

"This method of attack complicates remediation via technologies that rely on blacklisting because the number of compromised websites (now acting as malware hosts) is in the thousands.”

And we also reported the same method being used in a random malvertising attack in 2010:

“ScanSafe STAT has been investigating an ongoing series of attacks which has been a hotbed for zero day exploits over the first quarter of 2010. The attackers are using three layers of legitimate sites. Two layers are compromised websites used to host malicious content that is then subsequently pushed to a third layer of legitimate websites via syndicated ads.”

The above references aren't to minimize the severity of mass-meshing style attacks, but rather just to point out that the mass-meshing technique isn't new.

Indeed, today it is pretty common to see interwoven attacks in which the compromised sites work in concert to interchangeably serve as conduit, redirector, and/or the actual malware host.

And while it does pose some additional challenges, overall security vendors seem to be coping fairly well with it. (Though obviously anyone relying purely on blacklisting would have a problem, but most use more layered defenses).

I have to say though that while the attack method isn't new, mass-meshing is a pretty cool, new buzzword to describe it.

Mary Landesman is an antivirus professional and senior security researcher for ScanSafe, now part of Cisco. In 2009 she was awarded a Microsoft MVP for her work in consumer security.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2011-3154
Published: 2014-04-17
DistUpgrade/DistUpgradeViewKDE.py in Update Manager before 1:0.87.31.1, 1:0.134.x before 1:0.134.11.1, 1:0.142.x before 1:0.142.23.1, 1:0.150.x before 1:0.150.5.1, and 1:0.152.x before 1:0.152.25.5 does not properly create temporary files, which allows local users to obtain the XAUTHORITY file conte...

CVE-2013-2143
Published: 2014-04-17
The users controller in Katello 1.5.0-14 and earlier, and Red Hat Satellite, does not check authorization for the update_roles action, which allows remote authenticated users to gain privileges by setting a user account to an administrator account.

CVE-2014-0036
Published: 2014-04-17
The rbovirt gem before 0.0.24 for Ruby uses the rest-client gem with SSL verification disabled, which allows remote attackers to conduct man-in-the-middle attacks via unspecified vectors.

CVE-2014-0054
Published: 2014-04-17
The Jaxb2RootElementHttpMessageConverter in Spring MVC in Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 does not disable external entity resolution, which allows remote attackers to read arbitrary files, cause a denial of service, and conduct CSRF attacks via crafted XML, aka an XML External ...

CVE-2014-0071
Published: 2014-04-17
PackStack in Red Hat OpenStack 4.0 does not enforce the default security groups when deployed to Neutron, which allows remote attackers to bypass intended access restrictions and make unauthorized connections.

Best of the Web